## Why

Plugin installability is now the next platform dependency: server creation, plugin marketplace display, and plugin bridge work all need a trusted registry of game management plugin manifests. This change adds the manifest validation and registry surface so only safe, well-formed plugins become available to the platform.

## What Changes

- Define the first plugin manifest contract for game management plugins, including identity, server type, create form schema, lifecycle actions, run capabilities, UI contribution, and scoped permissions.
- Add manifest validation in `plugins/` with schema fixtures and tests for valid and unsafe manifests.
- Add platform domain, repository, service, DTO, validator, and API handling for registering, listing, and inspecting installed plugin metadata.
- Reject or disable unsafe manifest requests such as raw host paths, direct run sockets, raw credentials, or raw AI provider keys.
- Keep plugin marketplace metadata focused on game server management plugins, not billing, cloud host sales, or unrelated SaaS marketplace features.

## Capabilities

### New Capabilities

- `plugin-registry-and-manifest-validation`: Validates game management plugin manifests and exposes installed plugin registry metadata through platform APIs.

### Modified Capabilities

- None. This change builds on the bootstrap plugin and platform-core constraints, which have not yet been archived into `openspec/specs/`.

## Impact

- Affects `plugins/` manifest schemas, fixtures, SDK-adjacent types, and validation tests.
- Affects `platform/` plugin domain, DTOs, models, repositories, services, validators, routes, and API tests.
- Adds or updates verification commands for plugin schema tests, platform API tests, `scripts/check-structure.sh`, and strict OpenSpec validation.